On Multi-Point, In-Network Filtering of Distributed Denial-of-Service Traffic Mingwei Zhang∗, Lumin Shi∗, Devkishen Sisodia∗, Jun Li∗, Peter Reihery ∗ University of Oregon fmingwei, luminshi, dsisodia,
[email protected] y University of California, Los Angeles
[email protected] Abstract—Research has shown that distributed denial-of- in a common language. Further, it is also unknown how these service (DDoS) attacks on the Internet could often be better solutions perform under insufficient knowledge of the attacks handled by enlisting the in-network defense of multiple au- or against intelligent adversaries who can dynamically revise tonomous systems (ASes), rather than relying entirely on the victim’s Internet Service Provider at the edge. Less noticed their attack strategies to escape defense. Without a quantitative but important is the fact that an in-network defense can also comparison, it is hard for a DDoS victim to select the most remove DDoS traffic from the Internet early en route to the suitable solution to achieve its defense goal and meet the victim, thus decreasing the overall load on the Internet and resource requirements. reducing chances of link congestion. However, it is not well In this paper, we introduce a modeling and simulation understood to what degree different in-network defense strategies can achieve such benefits. In this paper, we model the existing framework to systematically evaluate in-network DDoS de- two main categories of in-network DDoS defense algorithms fense algorithms. The framework contains a general model (PushBack, SourceEnd) and propose a new type of algorithm that can describe the attack and defense for various defense (StrategicPoints).